WO2017032346A1 - 基于无线安全的客户机自连接保护方法和系统 - Google Patents

基于无线安全的客户机自连接保护方法和系统 Download PDF

Info

Publication number
WO2017032346A1
WO2017032346A1 PCT/CN2016/101526 CN2016101526W WO2017032346A1 WO 2017032346 A1 WO2017032346 A1 WO 2017032346A1 CN 2016101526 W CN2016101526 W CN 2016101526W WO 2017032346 A1 WO2017032346 A1 WO 2017032346A1
Authority
WO
WIPO (PCT)
Prior art keywords
base station
information
client
historical
connection
Prior art date
Application number
PCT/CN2016/101526
Other languages
English (en)
French (fr)
Inventor
吴旭莲
臧玉生
刘红光
Original Assignee
盾宇（上海）信息科技有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 盾宇（上海）信息科技有限公司 filed Critical 盾宇（上海）信息科技有限公司
Publication of WO2017032346A1 publication Critical patent/WO2017032346A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/088—Access security using filters or firewalls
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/12—Detection or prevention of fraud

Definitions

  • the present invention relates to network security, and in particular to a wireless security based client self-connection protection method and system.
  • Wireless security usually consists of two parts: base station security and client security.
  • Base station security is relatively common. It is mainly managed by the base station to implement access points, such as password protection and connection restriction to ensure the security and operation of the base station. stable. However, since most base stations are not safely controlled by the client, the client is always passive in the wireless connection. Although it has the option, the traditional SSID+password authentication method is too simple.
  • the pseudo base station for the purpose of deception also means that the personal information of the client can be intercepted at will. Therefore, the client side must take certain security measures during the wireless connection process to actively protect personal information security.
  • the more common technical solutions in current connection security are:
  • Patent application number CN201110337877.6
  • the present invention discloses a method and a site for WLAN access point verification, which are related to the field of communication, and are used to solve the problem that a spoofed AP accesses an STA user to an illegal network to steal information of an STA user or control an STA user to perform an illegal behavior.
  • the user is suffering from a loss problem.
  • the method provided by the present invention includes: acquiring an access point identifier information element sent by an access point; and verifying the access point according to the access point identifier information element. Sending an authentication request information element to the access point, the verification request information element is used to instruct the access point to return a verification response information element; acquiring an authentication response information element returned by the access point; according to the verification response information element Verify the access point.
  • the patent document belongs to the base station verification, and the access point needs to provide an authentication method based on the access point identification information element, so that the verification request sent by the user can take effect and be correctly returned, so the patent document needs to modify the base station end.
  • the present invention is directed to historical base station information, thereby concentrating all authenticity identification work on the client, and does not involve any changes at the base station side.
  • the invention provides a method, a client, a server and a system for identifying a fake wifi, and belongs to the field of wireless network security.
  • the method includes: the client scans the service set identifier SSID of the wifi, and obtains the MAC address corresponding to the service set identifier SSID; and queries whether the MAC address exists in the MAC address library, when the query result indicates the When the MAC address exists and is located in the MAC black library of the MAC address pool, The service set identifier SSID corresponding to the MAC address is falsely identified.
  • This patent document identifies a pseudo base station using a MAC black library that records a fake wifi MAC address library.
  • this patent document does not teach how to categorize a pseudo-base station that has not yet implemented risk behavior into a black library. These decoy pseudo base stations will be outside the black library for a long time. In the present invention, even if the pseudo base station does not implement the risk behavior, it can be identified before the data connection.
  • the invention discloses a method and a device for monitoring a pseudo wireless access point AP, wherein the method includes: each legal AP deployed by the operator monitors the pseudo AP in the following manner: multiple legal APs managed by the operator adopt a cellular type
  • the networking solution is deployed.
  • Each legal AP works on the specified channel, and scans the beacon frame sent by the nearby AP while performing data transmission.
  • the scanned AP information is extracted from the obtained beacon frame.
  • the AP information is compared with the legal AP information database.
  • the legal AP information database stores the information of the legal AP. When the extracted AP information is not in the legal AP information database, it is determined that the scanned AP is a pseudo AP.
  • the patent document needs to rely on the legal AP database provided by the operator as a basis for matching, belongs to the base station authentication, does not belong to the client side verification, even if a legitimate AP recognizes the pseudo AP, but for the client, The information of the pseudo AP cannot be known, and even if the legal AP can notify the client that the pseudo AP is found, the client cannot determine whether the AP that issued the notification itself is a legal AP or a pseudo AP; and the present invention is from the client. From the perspective, it does not depend on the legal AP database provided by the operator as the basis for matching.
  • the pseudo AP in the patent document refers to an illegal, unregistered AP, and the AP spoofing information caused by the resetting of the legal AP is not taken into consideration, so the present invention can effectively target the spoofing pseudo Base station.
  • the legal AP can scan the beacon frame sent by the nearby AP
  • the pseudo base station can also scan the beacon frame sent by the nearby AP, and the pseudo base station can disguise its beacon frame as the beacon sent by the nearby AP.
  • the frame can still be deceived by overwriting the frame transmit power over the legitimate AP; however, such a tricky approach does not work for the present invention.
  • the patent document gives a technical revelation that is completely contrary to the present invention.
  • the patent document specification [0004] describes that "the current governance for pseudo-AP mainly includes... adding a pseudo AP to the mobile terminal. Monitoring function... It is necessary to install a corresponding application software on the user's mobile phone, and every time a user goes to a new wireless local area network, the data update must be performed again, and it is difficult to achieve seamless monitoring of the pseudo AP.
  • the invention relates to a system and method for realizing wireless authentication and encryption of a mobile terminal, which comprises a mobile terminal for transmitting an IMEI of a self device to a network access point and failing in the original wireless connection password authentication when establishing communication with the network access point for the first time.
  • the system and method for implementing wireless authentication and encryption of a mobile terminal using the same structure after the wireless connection password in the AP is modified, if the mobile terminal device has connected to the AP, the mobile device can use the IMEI for authentication, and the IMEI Based on the basis, the encrypted key is regenerated to facilitate the connection network of the mobile terminal user and improve the user experience, and has a wider application range.
  • This patent document is completely different from the technical problem solved by the present invention.
  • the reason for this patent document is that its proposed use of IMEI and MAC address as a new identification tag instead of the traditional combination of SSID and password makes it possible to connect even if the historical AP replaces the new password client, for convenience.
  • the purpose of the present invention is to achieve the purpose of personal information security by using various identification combinations.
  • the object of the present invention is to provide a method and system for self-connection protection of a client based on wireless security, thereby solving the problem that the client currently has no active connection self-protection by automatically connecting the base station based on the SSID and the password. problem.
  • a wireless security-based client self-connection protection method includes the following steps:
  • Step 1 The connection object information to be identified is obtained, where the connection object information to be identified includes base station information and/or authentication information corresponding to the base station;
  • Step 2 Perform authenticity identification on the connection object to be identified according to the matching result of the connection object information to be identified and the historical connection object information of the client locality;
  • the historical connection object information includes historical base station information and/or historical authentication information
  • the historical base station information includes any one or any of the following information:
  • the historical authentication information includes:
  • said step 1 comprises the following steps performed before the client connects to the base station data:
  • Step 1.1 Acquire first radio identifier information and second radio identifier information of the base station
  • the step 2 includes the following steps performed before the client connects to the base station data:
  • Step 2.1 Matching the combination of the first wireless identification information and the second wireless identification information with the historical base station information, and performing authenticity identification on the base station according to the matching result;
  • the combination of the first wireless identification information and the second wireless identification information is recorded as a label
  • the step 1.1 includes the following steps:
  • the step 1 comprises the following steps:
  • Step 1-1 The connection initiated by the client is used as a reliable connection, and the information about the base station acquired when the reliable connection is initiated is locally stored as historical base station information, and/or the authentication information of the authentication site corresponding to the base station is used as the historical authentication. information;
  • Step 2 includes the following steps performed in the client to base station data connection:
  • Step 2-1 Determine whether the subsequently acquired base station information matches the historical base station information, and/or whether the authentication information of the authentication site corresponding to the subsequently acquired base station matches the historical authentication information. .
  • the base station information includes a firmware label
  • the method for acquiring base station information includes the following steps:
  • Step i1 receiving a response and/or feedback message of the authentication station corresponding to the base station and/or the base station to the packet sent by the client;
  • Step i2 extracting keywords from the response and/or feedback message to form a firmware tag as a base station information.
  • the message sent by the client refers to a message sent by the client to the firmware device of the base station in the reliable connection and/or the authentication station corresponding to the base station.
  • the step 1 includes the following steps performed before the client logs in to the authentication site corresponding to the base station:
  • Step 101 Acquire a site label of an authentication site corresponding to the base station.
  • Step 102 Match the site label with the historical authentication information, and perform authenticity identification on the base station according to the matching result.
  • a wireless security-based client self-connection protection system includes the following devices:
  • a first acquiring device acquiring connection object information to be identified, where the connection object information to be identified includes base station information and/or authentication information corresponding to the base station;
  • a first identifying means performing authenticity identification on the connection object to be identified according to the matching result of the connection object information to be identified and the historical connection object information local to the client;
  • the historical connection object information includes historical base station information and/or historical authentication information
  • the historical base station information includes any one or any of the following information:
  • the historical authentication information includes:
  • the authentication site corresponding to the base station gives feedback information to the client.
  • the client logs in to the site corresponding to the base station.
  • the first obtaining means comprises the following means:
  • a second acquiring device acquiring, before the data connection between the client and the base station, the first wireless identifier information and the second wireless identifier information of the base station;
  • the first identification device includes the following devices:
  • a second identifying means matching the combination of the first wireless identification information and the second wireless identification information with the historical base station information before the client and the base station are connected to the data, and authenticating the base station according to the matching result;
  • the combination of the first wireless identification information and the second wireless identification information is recorded as a label
  • the second obtaining device comprises the following device:
  • a first policy device when acquiring the second wireless identity information of the base station, randomly selecting a combination of a non-default authentication information or a plurality of non-default authentication information of the base station as the second wireless identity information of the base station.
  • the first obtaining means comprises the following means:
  • the third obtaining device the connection initiated by the client is used as a reliable connection, and the base station information acquired when the reliable connection is initiated is locally stored as historical base station information, and/or the authentication information of the authentication site corresponding to the base station is used as the historical authentication. information;;
  • the first identification device includes the following devices:
  • a third identification device in the data connection between the client and the base station, determining whether the subsequently acquired base station information matches the historical base station information as the data connection time changes, and/or the authentication of the authentication site corresponding to the subsequently acquired base station Whether the information matches the historical authentication information.
  • the wireless security-based client self-connection protection system further includes a first receiving device, a first extracting device; the base station information includes a firmware tag, and the method for acquiring base station information is performed by:
  • a first receiving device receiving a response and/or a feedback message of the authentication station corresponding to the base station and/or the base station to the message sent by the client;
  • the first extracting means extracts keywords from the response and/or feedback messages to form a firmware tag as base station information.
  • the message sent by the client refers to a message sent by the client to the firmware device of the base station in the reliable connection and/or the authentication station corresponding to the base station.
  • the first obtaining means comprises the following means:
  • a fourth acquiring device acquiring, before the client logs in to the authentication site corresponding to the base station, a site label of the authentication site corresponding to the base station;
  • the fourth identification device before the client logs in to the authentication site corresponding to the base station, matches the site label with the historical authentication information, and performs authenticity identification on the base station according to the matching result.
  • the present invention has the following beneficial effects:
  • the present invention provides a scheme for actively establishing a wireless self-connection protection mechanism from the client side, and identifies the hotspot of the base station to be identified by the connection object before the wireless data connection, and checks whether the historical base station is The same (class/s), according to the level of security alert, match the filter and inform the client or directly control the connection, so that the client can actively identify the pseudo base station, thus ensuring its own information security.
  • the target base station masquerades as a client's historical access base station point by SSID and password, the client is When attempting to connect, the pseudo base station can be actively identified and prompted by the user.
  • FIG. 1 is a schematic structural diagram of a wireless security-based client self-connection protection system according to the present invention
  • FIG. 2 is a schematic flowchart diagram of a wireless security-based client self-connection protection method according to the present invention
  • FIG. 3 is a schematic diagram of a self-connection principle of a conventional client
  • FIG. 4 is a schematic diagram of a self-connection protection principle of a client in the present invention.
  • Figure 5 is a flow chart showing the operation of a preferred application of the present invention.
  • a wireless security-based client self-connection protection system includes the following devices:
  • a first acquiring device acquiring connection object information to be identified, where the connection object information to be identified includes base station information and/or authentication information corresponding to the base station;
  • a first identifying means performing authenticity identification on the connection object to be identified according to the matching result of the connection object information to be identified and the historical connection object information local to the client;
  • the historical connection object information includes historical base station information and/or historical authentication information
  • the historical base station information includes any one or any of the following types of information:
  • the historical authentication information includes:
  • the authentication site corresponding to the base station gives feedback information to the client.
  • the first obtaining means comprises the following means:
  • a second acquiring device acquiring first wireless identification information and second information of the base station before the client connects to the data of the base station Wireless identification information;
  • the first identification device includes the following devices:
  • a second identifying means matching the combination of the first wireless identification information and the second wireless identification information with the historical base station information before the client and the base station are connected to the data, and authenticating the base station according to the matching result;
  • the combination of the first wireless identification information and the second wireless identification information is recorded as a label
  • the second obtaining device includes the following devices:
  • a first policy device when acquiring the second wireless identity information of the base station, randomly selecting a combination of a non-default authentication information or a plurality of non-default authentication information of the base station as the second wireless identity information of the base station.
  • the first obtaining means comprises the following means:
  • the third obtaining device the connection initiated by the client is used as a reliable connection, and the base station information acquired when the reliable connection is initiated is locally stored as historical base station information, and/or the authentication information of the authentication site corresponding to the base station is used as the historical authentication. information;;
  • the first identification device includes the following devices:
  • a third identification device in the data connection between the client and the base station, determining whether the subsequently acquired base station information matches the historical base station information as the data connection time changes, and/or the authentication of the authentication site corresponding to the subsequently acquired base station Whether the information matches the historical authentication information.
  • the wireless security-based client self-connection protection system further includes a first receiving device and a first extracting device; the base station information includes a firmware tag, and the method for acquiring base station information is performed by:
  • a first receiving device receiving a response and/or a feedback message of the authentication station corresponding to the base station and/or the base station to the message sent by the client;
  • the first extracting means extracts keywords from the response and/or feedback messages to form a firmware tag as base station information.
  • the message sent by the client refers to a message sent by the client to the firmware device of the base station in the reliable connection and/or the authentication station corresponding to the base station.
  • the first obtaining means comprises the following means:
  • a fourth acquiring device acquiring, before the client logs in to the authentication site corresponding to the base station, a site label of the authentication site corresponding to the base station;
  • the fourth identification device before the client logs in to the authentication site corresponding to the base station, matches the site label with the historical authentication information, and performs authenticity identification on the base station according to the matching result.
  • the wireless security-based client self-connection protection system can pass a wireless security-based client The process steps of the self-connection protection method are implemented.
  • the wireless security-based client self-connection protection method can be understood by those skilled in the art as one embodiment of the wireless security-based client self-connection protection system.
  • the wireless security-based client self-connection protection method is specifically as follows.
  • a wireless security-based client self-connection protection method includes the following steps:
  • Step 1 Obtain information about the connection object to be identified
  • Step 2 Perform authenticity identification on the connection object to be identified according to the matching result of the connection object information to be identified and the historical connection object information of the client locality;
  • the client can establish a connection with a base station (such as a wifi base station) in a wireless manner (for example, a short-range wireless communication method such as wifi) to join the wireless local area network where the base station is located, and then connect to the Internet through the base station.
  • a base station such as a wifi base station
  • the client may be a smart phone; the client may also be an IoT terminal, such as a routing box for a home appliance, and the base station is a wireless base station.
  • connection object to be identified may be a base station, and correspondingly, the connection object information to be identified is base station information, and the historical connection object information is historical base station information.
  • the connection object to be identified may also be an authentication platform (for example, an authentication site) corresponding to the base station.
  • the connection object information to be identified is authentication information corresponding to the base station, and the historical connection object information is historical authentication information.
  • the historical connection object information may be formed locally by the client by recording all or part of the information of the real base station and/or the authentic authentication site.
  • step 1 can be performed before the client establishes a true connection with the base station.
  • Step 1 can also be performed in a real connection between the client and the base station.
  • step 1 and step 2 can be repeatedly performed to identify the current client in the actual connection between the client and the base station.
  • the connection object is a real base station or a pseudo base station whose signal transmission power is stronger than that of the real base station.
  • the real connection refers to a data connection, and the object of the present invention is to prevent the pseudo base station from acquiring data of the client (especially private data).
  • connection object to be identified includes a data connection object to be established, and the data connection object is to be continued.
  • the connection object to be identified may be a connection object of the client that has not established a data connection and depends on the authenticity recognition result to consider whether to establish a data connection, that is, the connection object to be identified includes a data connection object to be established, and correspondingly
  • the connection object information to be identified includes data connection object information to be established; the connection object to be identified may also be an established data connection of the client and needs to rely on the authenticity recognition result to consider whether the connection object can continue to maintain the data connection.
  • connection object to be identified includes a data connection object to be continuously maintained, and correspondingly, the connection object information to be identified includes information to be continuously maintained, and further, when the client establishes a data connection with the real base station, If the transmit power of the pseudo base station is greater than the true base station, the pseudo base station may cause interference and shielding to the true base station, so that the client is forcibly connected to the pseudo base station, and therefore, even if the client is connected to the real base station at the current time, Can not be excluded in the data connection will be forced to connect next time To pseudo-yl Station, therefore, for the client to continue the data connection at the next moment, it is necessary to carry out authenticity identification. That is to say, the base station at the next moment is a real identity to be confirmed by the client, and then confirm whether to maintain the data connection or re-establish The connection object to be identified for the data connection.
  • step 2 if the matching result of the connection object information to be identified and the historical connection object information of the client is matched, the connection object to be identified is recognized as true; if the connection object information to be identified and the history of the client local are If the matching result of the connection object information is a mismatch, the connection object to be identified is identified as a pseudo.
  • the historical connection object information includes historical base station information and/or historical authentication information.
  • the client local is local to the base station and the Internet.
  • the client local may be a storage device inside the client, or may be a storage device under the same terminal as the client.
  • the historical base station information may be historical information formed by the client to the secondary data connection base station.
  • the method may be formed by: before the client performs authenticity identification on the base station that is to be established with the data connection to establish a data connection, the client forms the data storage of the base station after establishing a data connection with the base station.
  • Historical information Preferably, the past refers to the first time or the previous time in history.
  • the historical base station information may be historical information formed by the base station of the current data connection base station.
  • the method may be formed by: after the active connection with the base station is established, the client immediately stores the base station information as the historical information (for example, in the next time slot), and then acquires again during the data connection process. After the base station information, the base station information constitutes history information with respect to the base station information obtained again.
  • the historical base station information may be a historical base station information table stored on the client, wherein the base station information described in the historical base station information table is preferably preset. For example, if it is desired to designate the connected base station of the client as a limited number of base stations, the base station information of the plurality of base stations may be previously set in the history base station information table.
  • the historical authentication information includes feedback information given by the authentication site corresponding to the base station to the client.
  • the feedback information given by the authentication site to the client may be historical information formed by the client to log in to the authentication site corresponding to the base station, or may be the authentication feedback of the site for the specific packet.
  • the historical authentication information may be historical information formed by the client to log in to the authentication site corresponding to the base station.
  • a wifi hotspot is built in the public places of the city (such as transportation sites, restaurants), in order to enable users to quickly and conveniently access the Internet.
  • the authentication site (such as i-Shanghai's authentication site) obtains the Internet password (the security key of wifi), and then the Internet password client can access the wifi hotspot and connect to the Internet.
  • the method may be formed by: before the client performs the authenticity identification with the authentication site corresponding to the base station to send the login information, the client sends the data connection to the base station after actively establishing the data connection with the base station.
  • Base station corresponding recognition The certificate site information storage is formed as the history information.
  • the past refers to the first time or the previous time in history.
  • the user can be notified by prompting the security information, and the user is designated to reconnect.
  • the user can accept the new inconsistent base station by (adding/replace) the method of granting, clearing or updating the historical base station information, and identify the identified pseudo base station as a true base station.
  • the connection object to be identified by the client is a base station that has not yet been connected to the data. Therefore, the base station needs to be authenticated before the data connection. If it is a true base station, the client establishes a data connection with the base station. As a pseudo base station, the client generates a prompt for the pseudo base station.
  • the wireless identification information of the base station can be used as the identification basis of the authentic base station, and the active connection self-protection is implemented for the client.
  • the step 1 includes the following steps performed before the client connects to the base station data:
  • Step 1.1 Acquire first radio identifier information and second radio identifier information of the base station
  • the step 2 includes the following steps performed before the client connects to the base station data:
  • Step 2.1 Matching the combination of the first wireless identification information and the second wireless identification information with the historical base station information, and performing authenticity identification on the base station according to the matching result;
  • the combination of the first wireless identification information and the second wireless identification information is recorded as a label
  • the first wireless identification information may be plaintext identification information of the base station, where the plaintext identification information refers to public information that can be obtained by the pseudo base station and can be copied and spoofed, for example, the SSID (Service Set Identifier) of the base station, and the ESSID (Extended) Service Set Identifier), the network name of the local area network where the base station is located, the BSSID (Basic Service Set Identifier), the channel, and the device address.
  • the ESSID can be regarded as the wifi network name in the mobile phone WLAN.
  • the second wireless identification information may be wireless identification information other than the plaintext identification information, and is recorded as non-clear text identification information, such as device manufacturer information.
  • the BSSID is the MAC address of the wireless route.
  • the randomness is relative to the base station, that is, the randomness refers to being irregular to the base station, rather than being fixed.
  • the pseudo base station may set the non-clear text identification information in advance to achieve the purpose of camouflage;
  • the second wireless identification information may be a non-clear text identification information, sometimes several non-clear text identifiers. The information, in which the number and type of non-plain identification information can be changed in each time the base station information is acquired, so that the pseudo base station can not find the law to achieve random purpose.
  • the first wireless identification information may also be default authentication information that is connected to the base station.
  • the default authentication information refers to base station information that the base station must obtain after the base station is searched by the client or the client finds the base station, for example, the base station.
  • SSID Service Set Identifier
  • ESSID Extended Service Set Identifier
  • the second wireless identity information of the base station is obtained, a combination of a non-default authentication information of the base station or multiple non-default authentication information is randomly used as the second wireless identity information of the base station.
  • the randomness is relative to the base station, that is, the randomness refers to being irregular to the base station, rather than being fixed.
  • the pseudo base station may pre-set the non-default authentication information to achieve the purpose of camouflage;
  • the second wireless identification information may sometimes be a non-default authentication information, sometimes several non-default authentication. The information, in which the number and type of the non-default authentication information can be changed in each time the base station information is acquired, so that the pseudo base station cannot find the law to achieve randomness.
  • the conventional client only uses the ESSID as the basis for identifying the base station.
  • the pseudo base station can completely disguise its own ESSID as "abc", "xyz" or "123".
  • the client defines the representation tag as a combination of ESSID, BSSID, and channel, rather than using the ESSID alone as the identification base station.
  • the client informs the user that the ESSID needs to be manually specified instead of the automatic connection, because the target connection base station may not be previously securely connected by the historical base station, and may be a pseudo base station. As shown in FIG.
  • the indication label is defined as a combination of ESSID, BSSID, and channel.
  • any combination of the ESSID, BSSID, and channel of a base station causes the combination to be mismatched with the historical base station information, it can be identified as a pseudo base station.
  • the items that cause the combination mismatch have been underlined in FIG.
  • the connection object to be identified by the client is the base station that is to continue to maintain the data connection object, because the client may be forced to connect to the pseudo base station during the data connection between the client and the real base station, It is necessary to perform authenticity identification on the current data connection base station periodically or irregularly in the data connection. If the current data connection base station is a true base station, the client continues to maintain the data connection with the real base station, if the current data connection base station As a pseudo base station, the client directly disconnects the data connection or generates a prompt for the pseudo base station.
  • the firmware label of the base station can be used as the identification basis of the authentic base station, and the active connection self-protection is implemented for the client.
  • the step 1 includes the following steps:
  • Step 1-1 The connection initiated by the client is used as a reliable connection, and the information about the base station acquired when the reliable connection is initiated is locally stored as historical base station information, and/or the authentication information of the authentication site corresponding to the base station is used as the historical authentication. information;;
  • the step 2 includes the following steps performed in the client-base station data connection:
  • Step 2-1 determining the subsequently acquired base station information and the historical base station letter as the data connection time elapses Whether the information matches, and/or whether the authentication information of the authentication site corresponding to the subsequently acquired base station matches the historical authentication information.
  • the client After confirming that the base station is a true base station (and correspondingly confirming that the authentication station corresponding to the base station is a true authentication station) through the foregoing steps 1.1-1.2 or other manners, the client actively initiates a connection to the real base station and considers the connection to be a reliable connection. That is to say, the client will initiate a connection only when it is confirmed that the base station is a true base station, otherwise the client will not initiate a connection when the authenticity of the base station is not recognized.
  • the base station information (and/or the authentication information of the authentication site) needs to be acquired multiple times through steps 1-1 and 2-1.
  • the base station information acquired when the reliable connection is initiated is the base station information acquired last time before the client initiates the connection.
  • the authentication information of the corresponding authentication site wherein the client identifies that the base station is a true base station by using the last acquired base station information (or identifies the authentication site as a true authentication site by using the authentication information), thereby establishing a reliable connection. Therefore, the base station information acquired last time before the client actively initiates the connection corresponds to a reliable connection.
  • the base station information acquired for the first time after establishing the reliable connection may also be used as the base station information acquired when the reliable connection is initiated.
  • the subsequently acquired base station information matches the historical base station information, specifically, the subsequently acquired base station information is matched with the base station information acquired when the corresponding reliable connection is initiated, and if the matching is consistent, the client continues to maintain the current data connection. If the match is inconsistent, the client disconnects the current data connection or generates a pseudo base station prompt.
  • the client Continue to maintain the current data connection. If the match is inconsistent, the client disconnects the current data connection or generates a pseudo base station prompt.
  • the base station information includes a firmware label.
  • the step 1-1 is specifically that the connection initiated by the client is a reliable connection, and the first acquired firmware label corresponding to the reliable connection is stored as historical base station information.
  • Step 2-1 specifically determines whether the firmware tag acquired in the subsequent time matches the firmware tag obtained for the first time as the data connection time elapses.
  • Step i1 receiving a response and/or feedback message of the authentication station corresponding to the base station and/or the base station to the packet sent by the client;
  • Step i2 extracting keywords from the response and/or feedback message to form a firmware tag as base station information.
  • the client After establishing the data connection, the client communicates with the base station privately by sending packets of the application layer and the data link layer (for example, TCP/UDP protocols such as HTTP, LLDP, ICMP, DHCP, or SNMP), and receiving the base station for the client.
  • TCP/UDP protocols such as HTTP, LLDP, ICMP, DHCP, or SNMP
  • the response and/or feedback message of the message sent by the machine for example, TCP/UDP protocols such as HTTP, LLDP, ICMP, DHCP, or SNMP
  • the message sent by the client refers to a message sent by the client to the firmware device of the base station in the reliable connection, and the message requires the base station currently connected with the client data to return the firmware device information of the base station.
  • Response and/or feedback message and then the client extracts keywords about the firmware device information from the response and/or feedback message to form a firmware tag.
  • the firmware device information may be a firmware release date, a firmware brand manufacturer, a firmware version number, and a firmware management identifier.
  • the response may be a presence or absence of a response, a TCP connection request response, or the like.
  • the firmware tag may be identified by the tag “tag1 (response message first key)”, “tag2 (response message second key)”, “tag3 (response/no response)", “tag4 (IP network address number) ), “tag5 (device management identifier)” and “tag6 (9000 port rotation training TCP connection request response case).
  • the packet sent by the client may be a packet sent by the client to the authentication station corresponding to the base station in the reliable connection.
  • the packet may be an SNMP packet.
  • firmware tag acquired in the subsequent time is inconsistent with the first acquired firmware tag, the user is alerted that the base station connected to the client has changed, prompting the interruption of the connection with the current base station to ensure security.
  • the message requires that the firmware tag returned by the base station currently connected to the client data is a random combination of multiple firmware device information.
  • the random combination of the various firmware device information is relative to the base station, that is, the randomness refers to being irregular to the base station, rather than being fixed.
  • the randomness is not purely random, and the firmware device information in the random combination can be set based on factors such as time, signal strength of the connected object, and IP protocol detection supported by the client. This has the advantage that the random combinations corresponding to the firmware tags acquired multiple times in the data connection are different, so that it is possible to expose all the identification methods of the client to the pseudo base station by multiple recognitions to avoid one recognition.
  • the message is for a firmware device of a base station in a reliable connection, and therefore, the firmware device of the pseudo base station is different from the firmware device of the real base station, so the firmware device information of the real base station is unknown to the pseudo base station.
  • the firmware device information required for the message of the firmware device of the base station in the reliable connection is random to the pseudo base station.
  • connection object to be identified of the client is a to-be-registered authentication site corresponding to the base station that has not yet connected the data.
  • the step 1 includes the following steps performed before the client logs in to the authentication site corresponding to the base station:
  • Step 101 Acquire a site label of an authentication site corresponding to the base station.
  • Step 102 Match the site label with the historical authentication information, and perform authenticity identification on the base station according to the matching result.
  • the site tag may be a site's DNS, a site server tag, an IP address, etc., used to identify the identity of the site. label.
  • the client Before allowing a client to access a wireless local area network base station, the client needs to be authenticated by a unified background authentication site to perform username authentication, and then obtain the Internet access. password.
  • the authentication site corresponding to the pseudo base station can be a phishing site, so that not only can the spoofing continue, but also the user's personalized user authentication information can be obtained.
  • the tag is further extended to the background authentication site detection (DNS, site server tag, IP address, etc.).
  • the client may form the site tag storage of the authentication site corresponding to the base station as the historical authentication information after establishing a data connection with the base station, so that the current client prepares the authentication site corresponding to the base station to be logged in.
  • the site label of the current authentication site is matched with the historical authentication information. If the matching is consistent, the current authentication site is identified as true, otherwise the identification is false.
  • the /avr MCU/embedded module embeds the wireless security-based client self-connection protection system provided by the present invention, and adopts the following steps:
  • the client determines whether there is a hotspot base station that is connectable and historically connected to the data; if yes, proceeds to the following steps to continue; if not, performs a manual trigger connection to the available hotspot base station;
  • the client After the communication is completed, the client records the presentation tag and the firmware tag of the hotspot base station as historical base station information.
  • the present invention also provides a computer readable storage medium storing a computer program, wherein the computer program in the computer readable storage medium causes a computer to perform the wireless security based client self-connection protection method, the computer
  • the read storage medium includes an optical disc, a magnetic disk, a ROM, a PROM, a VCD, a DVD, and the like;
  • the wireless security-based client self-connection protection method includes the following steps:
  • Step 1 Obtain connection object information to be identified, where the connection object information to be identified includes base station information And/or authentication information corresponding to the base station;
  • Step 2 Perform authenticity identification on the connection object to be identified according to the matching result of the connection object information to be identified and the historical connection object information of the client locality;
  • the historical connection object information includes historical base station information and/or historical authentication information.
  • the historical base station information includes any one or any of the following information:
  • the historical authentication information includes:
  • said step 1 comprises the following steps performed before the client connects to the base station data:
  • Step 1.1 Acquire first radio identifier information and second radio identifier information of the base station
  • the step 2 includes the following steps performed before the client connects to the base station data:
  • Step 2.1 Matching the combination of the first wireless identification information and the second wireless identification information with the historical base station information, and performing authenticity identification on the base station according to the matching result;
  • the combination of the first wireless identification information and the second wireless identification information is recorded as a label
  • the step 1.1 includes the following steps:
  • the step 1 comprises the following steps:
  • Step 1-1 The connection initiated by the client is used as a reliable connection, and the information about the base station acquired when the reliable connection is initiated is locally stored as historical base station information, and/or the authentication information of the authentication site corresponding to the base station is used as the historical authentication. information;
  • Step 2 includes the following steps performed in the client to base station data connection:
  • Step 2-1 Determine whether the subsequently acquired base station information matches the historical base station information, and/or whether the authentication information of the authentication site corresponding to the subsequently acquired base station matches the historical authentication information. .
  • the base station information includes a firmware label
  • the method for acquiring base station information includes the following steps:
  • Step i1 receiving a response and/or feedback message of the authentication station corresponding to the base station and/or the base station to the packet sent by the client;
  • Step i2 extracting keywords from the response and/or feedback message to form a firmware tag as base station information.
  • the message sent by the client refers to a message sent by the client to the firmware device of the base station in the reliable connection and/or the authentication station corresponding to the base station.
  • the step 1 includes the following steps performed before the client logs in to the authentication site corresponding to the base station:
  • Step 101 Acquire a site label of an authentication site corresponding to the base station.
  • Step 102 Match the site label with the historical authentication information, and perform authenticity identification on the base station according to the matching result.
  • system provided by the present invention and its various devices can be logically gated, except that the system provided by the present invention and its various devices are implemented in purely computer readable program code. Switches, ASICs, programmable logic controllers, and embedded microcontrollers are used to achieve the same functionality. Therefore, the system and its various devices provided by the present invention can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within hardware components; A device that implements various functions is considered to be either a software module that implements a method or a structure within a hardware component.

Abstract

本发明提供了一种基于无线安全的客户机自连接保护方法，包括：步骤1：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；步骤2：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息。本发明还提供相应的系统。基于当前客户机缺少自连接保护的现状，本发明给出从客户机端主动搭建无线自连接保护机制的方案，使得客户机能够主动识别伪基站，从而保障自身的信息安全。

Description

基于无线安全的客户机自连接保护方法和系统 技术领域
本发明涉及网络安全，具体地，涉及基于无线安全的客户机自连接保护方法和系统。
背景技术
随着我国全网覆盖计划的推进，客户机也渐渐的实现了随时随地连接入网，然而与此同时无线网络安全问题也引起了越来越多的关注。
无线安全通常由基站安全与客户机安全两部分组成，其中基站安全比较常见，其主要是由基站端对接入点进行管理，从而实施例如密码保护，连接限制等方式以保证基站的安全及运行稳定。然而由于大部分基站安全并不能由客户机主动把控，从而使得客户机在无线连接中始终处于被动，虽然拥有选择权，但是传统的SSID+密码的验证方式却也过于简单，客户机一旦连接上以诱骗为目的的伪基站，则也意味着客户端的个人信息能够被随意截获。因此，客户机端在无线连接过程中必须采取一定的安全防护措施，以主动保护个人信息安全。当前连接安全中较为常见的技术方案有：
(a)病毒查杀，通过一些安全软件的排查，找出系统中存在的“问题”程式，并对其进行限制或删除。
(b)安装特定的安全应用，安全应用中的临时数据及存储数据通常使用加密的方式，防止外泄，被篡改等。
(c)限制关键文件的访问，通过系统级修改使得数据存放位置无法从外部获取或者无权限访问。
然而上述传统技术方案在保护客户机信息安全的过程中也存在着各种无法规避的问题：
(a)“问题”程式的定义界限较为模糊，容易存在病毒遗漏或误查杀的情况出现，不止如此，这类病毒查杀软件相互间往往存在利益竞争，一旦互相攻击，则会出现绑架使用者的行为。
(b)这类安全应用覆盖面较窄，并且需要由于其特定性，容易产生暴力捆绑从而强加给客户机，同时，数据加密也存在一定被破解的可能，并不能从根本上保障其信息安全。
(c)系统级修改需要较高的管理员权限，而对于一般的客户机使用者来说门槛较高，不具有普遍性，而非专业的修改也可能会影响系统稳定性。
经对现有技术进行检索，发现如下相关文献。
相关检索结果1
名称：无线局域网接入点验证的方法及站点
专利申请号：CN201110337877.6
申请公布号：CN103096301A
该本明公开了一种无线局域网接入点验证的方法及站点，涉及通信领域，用于解决伪装AP将STA用户接入非法网络以窃取STA用户的信息或控制STA用户进行非法行为，导致STA用户受到损失问题。本发明提供的方法包括：获取接入点发送的接入点标识符信息元素；根据所述接入点标识符信息元素对所述接入点进行验证。向接入点发送验证请求信息元素，所述验证请求信息元素用于指示所述接入点返回验证响应信息元素；获取所述接入点返回的验证响应信息元素；根据所述验证响应信息元素对所述接入点进行验证。
技术要点比较：
该专利文献属于基站验证，接入点需要提供基于接入点标识信息元素的验证方法，这样用户发送的验证请求才能生效，并得到正确返回，因此该专利文献中需要对基站端进行改动。而本发明针对于历史基站信息，从而将全部的真伪识别工作集中在客户机完成，并不涉及基站端的任何改动。
相关检索结果2
名称：识别虚假wifi的方法、客户端、服务器端和系统
专利申请号：CN201410447084.3
申请公布号：CN104219670A
该发明提供了一种识别虚假wifi的方法、客户端、服务器端和系统，属于无线网络安全领域。其中，所述的方法包括：客户端扫描wifi的服务集标识SSID，并获取所述服务集标识SSID对应的MAC地址；在MAC地址库中查询所述MAC地址是否存在，当查询结果表明所述MAC地址存在且位于MAC地址库的MAC黑库中时， 将所述MAC地址对应的服务集标识SSID进行虚假标识。
技术要点比较：
该专利文献利用记载有伪造的虚假wifi的MAC地址库的MAC黑库来识别伪基站，但是，该专利文献并没有给出如何将暂时还没有实施风险行为的诱骗伪基站归纳入黑库，因此这些诱骗伪基站将长期游离于黑库之外。而在本发明中，即使伪基站没有实施风险行为，一样可以在数据连接前识别出来。
相关检索结果3：
名称：用于监测伪无线接入点AP的方法及装置
专利申请号：CN201410638322.9
申请公布号：CN104349325A
该发明公开了一种用于监测伪无线接入点AP的方法及装置，其中方法包括：运营商部署的每一合法AP按如下方式监测伪AP：运营商管理的多个合法AP采用蜂窝型组网方案进行部署，每个合法AP工作在指定的信道上，且在进行数据传输的同时，扫描附近AP发出的信标帧；从获取的信标帧中提取扫描到的AP信息；将提取的AP信息与合法AP信息数据库进行比对，其中，合法AP信息数据库中存储合法AP的信息；当提取的AP信息不在合法AP信息数据库中，判定扫描到的AP为伪AP。
技术要点比较：
一方面，该专利文献需要借助于运营商提供的合法AP数据库作为匹配的依据，属于基站验证，不属于客户机端的验证，即使一个合法AP识别出了伪AP，但是对于客户机来讲，其一无法得知发现该伪AP的信息，其二即使合法AP能够通知客户机发现了伪AP，可是客户机不能确定发出该通知的AP本身是否为合法AP还是伪AP；而本发明从客户机角度出发，并不依赖于运营商提供的合法AP数据库作为匹配的依据。
另一方面，该专利文献中的伪AP指的是不合法、未登记AP，而合法AP进行复位设置而带来的AP诱骗信息问题则并没有被考虑进去，所以本发明能够有效针对诱骗伪基站。又一方面，既然合法AP能够扫描附近AP发出的信标帧，则伪基站同样能够扫描到附近AP发出的信标帧，进行伪基站可以将自身的信标帧伪装成附近AP发出的信标帧并将信号发射功率盖过合法AP，则仍可以实现诱骗；但是这样诱骗方式对本发明不起作用。
再一方面，该专利文献给出了与本发明完全相反的技术启示，具体地，该专利文献说明书第[0004]段记载到“目前针对伪AP的治理主要包括……在手机端增加伪AP监测功能……需要在用户手机上安装一个相应的应用软件，且用户每到一个新的无线局域网内，都要重新进行数据更新，难以实现伪AP的无缝监测”。
相关检索结果4：
名称：实现移动终端无线认证加密的系统及方法
专利申请号：CN201410837945.9
申请公布号：CN104468626A
该发明涉及一种实现移动终端无线认证加密的系统及方法，其中包括移动终端，用以在与网络接入点初次建立通信时发送自身设备的IMEI至网络接入点以及在原无线连接密码认证失败时发送包含自身设备IMEI的认证请求报文至网络接入点；网络接入点，用以保存移动终端对应的IMEI和MAC地址以及当原无线连接密码认证失败时对移动终端进行认证。采用该种结构的实现移动终端无线认证加密的系统及方法，当AP中的无线连接密码被修改后，如果该移动终端设备已经连接过该AP，该移动设备可以使用IMEI进行认证，并且以IMEI为基础，重新生成加密的密钥，方便移动终端用户的连接网络，提高用户使用体验，具有更广泛的应用范围。
技术要点比较：
该专利文献与本发明所解决的技术问题完全不同。该专利文献的理由在于其提出的使用IMEI与MAC地址作为新的标识标签从而取代SSID与密码的传统组合使得即使历史AP更换了新密码客户机仍然可以进行连接，这是出于方便的考虑。而本发明的目的则是采用多样的标识组合达到个人信息安全的目的。
发明内容
针对现有技术中的缺陷，本发明的目的是提供一种基于无线安全的客户机自连接保护方法和系统，从而解决目前客户机通过基于SSID和密码即自动连接基站导致无主动连接自保护的问题。
根据本发明提供的一种基于无线安全的客户机自连接保护方法，包括如下步骤：
步骤1：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；
步骤2：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息；
优选地，历史基站信息包括如下任意一种或任意多种信息：
-客户机往次数据连接基站形成的历史信息；
-客户机本次数据连接基站形成的历史信息；
-客户机上存有的历史基站信息表。
优选地，历史认证信息包括：
-基站对应的认证站点给与客户机的反馈信息
优选地，所述步骤1包括在客户机与基站数据连接前执行的如下步骤：
步骤1.1：获取基站的第一无线标识信息和第二无线标识信息；
所述步骤2包括在客户机与基站数据连接前执行的如下步骤：
步骤2.1：将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签；
优选地，所述步骤1.1，包括如下步骤：
-在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
优选地，所述步骤1包括如下步骤：
步骤1-1：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；
步骤2包括在客户机与基站数据连接中执行的如下步骤：
步骤2-1：判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
优选地，所述基站信息包括固件标签，获取基站信息的方法包括如下步骤：
步骤i1：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
步骤i2：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站 信息。
优选地，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
优选地，所述步骤1包括在客户机登录与基站对应的认证站点前执行的如下步骤：
步骤101：获取与基站对应的认证站点的站点标签；
步骤102：将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
根据本发明提供的一种基于无线安全的客户机自连接保护系统，包括如下装置：
第一获取装置：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；
第一识别装置：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息；
优选地，历史基站信息包括如下任意一种或任意多种信息：
-客户机往次数据连接基站形成的历史信息；
-客户机本次数据连接基站形成的历史信息；
-客户机上存有的历史基站信息表。
优选地，历史认证信息包括：
-基站对应的认证站点给与客户机的反馈信息客户机往次登录与基站对应的站点
优选地，所述第一获取装置包括如下装置：
第二获取装置：在客户机与基站数据连接前，获取基站的第一无线标识信息和第二无线标识信息；
所述第一识别装置包括如下装置：
第二识别装置：在客户机与基站数据连接前，将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签；
优选地，所述第二获取装置，包括如下装置：
-第一策略装置：在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
优选地，所述第一获取装置包括如下装置：
第三获取装置：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；；
所述第一识别装置包括的如下装置：
第三识别装置：在客户机与基站数据连接中，判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
优选地，所述基于无线安全的客户机自连接保护系统还包括第一接收装置、第一提取装置；所述基站信息包括固件标签，获取基站信息的方法通过如下装置执行：
第一接收装置：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
第一提取装置：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站信息。
优选地，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
优选地，所述第一获取装置包括如下装置：
第四获取装置：在客户机登录与基站对应的认证站点前，获取与基站对应的认证站点的站点标签；
第四识别装置：在客户机登录与基站对应的认证站点前，将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。与现有技术相比，本发明具有如下的有益效果：
基于当前客户机缺少自连接保护的现状，本发明给出从客户机端主动搭建无线自连接保护机制的方案，在无线数据连接前对待识别连接对象的基站热点做辨识，检查是否与历史基站为同一(类/个)，根据安全预警的级别，匹配筛选并告知客户机或直接管控连接，使得客户机能够主动识别伪基站，从而保障自身的信息安全。尤其是当目标基站通过SSID与密码伪装成客户机的历史访问基站点时，客户机在 尝试连接时能够主动识别出伪基站并给与用户提示。
附图说明
通过阅读参照以下附图对非限制性实施例所作的详细描述，本发明的其它特征、目的和优点将会变得更明显：
图1为本发明所提供基于无线安全的客户机自连接保护系统的结构示意图；
图2为本发明所提供基于无线安全的客户机自连接保护方法的流程示意图；
图3为传统客户机的自连接原理示意图；
图4为本发明中客户机的自连接保护原理示意图；
图5为本发明优选应用例的工作流程图。
具体实施方式
下面结合具体实施例对本发明进行详细说明。以下实施例将有助于本领域的技术人员进一步理解本发明，但不以任何形式限制本发明。应当指出的是，对本领域的普通技术人员来说，在不脱离本发明构思的前提下，还可以做出若干变化和改进。这些都属于本发明的保护范围。
根据本发明提供的一种基于无线安全的客户机自连接保护系统，包括如下装置：
第一获取装置：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；
第一识别装置：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息；
进一步地，历史基站信息包括如下任意一种或任意多种信息：
-客户机往次数据连接基站形成的历史信息；
-客户机本次数据连接基站形成的历史信息；
-客户机上存有的历史基站信息表。
进一步地，历史认证信息包括：
-基站对应的认证站点给与客户机的反馈信息。
优选地，所述第一获取装置包括如下装置：
第二获取装置：在客户机与基站数据连接前，获取基站的第一无线标识信息和第二 无线标识信息；
所述第一识别装置包括如下装置：
第二识别装置：在客户机与基站数据连接前，将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签；
所述第二获取装置，包括如下装置：
-第一策略装置：在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
优选地，所述第一获取装置包括如下装置：
第三获取装置：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；；
所述第一识别装置包括的如下装置：
第三识别装置：在客户机与基站数据连接中，判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
所述基于无线安全的客户机自连接保护系统还包括第一接收装置、第一提取装置；所述基站信息包括固件标签，获取基站信息的方法通过如下装置执行：
第一接收装置：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
第一提取装置：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站信息。
所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
优选地，所述第一获取装置包括如下装置：
第四获取装置：在客户机登录与基站对应的认证站点前，获取与基站对应的认证站点的站点标签；
第四识别装置：在客户机登录与基站对应的认证站点前，将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
所述基于无线安全的客户机自连接保护系统，可以通过一种基于无线安全的客户机 自连接保护方法的流程步骤实现。本领域技术人员可以将所述基于无线安全的客户机自连接保护方法理解为所述基于无线安全的客户机自连接保护系统的一个实施例。所述基于无线安全的客户机自连接保护方法，具体如下。
根据本发明提供的一种基于无线安全的客户机自连接保护方法，包括如下步骤：
步骤1：获取待识别连接对象信息；
步骤2：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
客户机可以采用无线方式(例如wifi等短距离无线通信方式)与基站(例如wifi基站)建立连接加入基站所在的无线局域网，然后通过基站连接入互联网。客户机可以是智能手机；客户机还可以是物联网终端，例如家用电器的路由盒子，基站为无线基站。
待识别连接对象可以是基站，相应地，待识别连接对象信息是基站信息，历史连接对象信息是历史基站信息。待识别连接对象还可以是与基站对应的认证平台(例如认证站点)，相应地，待识别连接对象信息是与基站对应的认证信息，历史连接对象信息是历史认证信息。历史连接对象信息可以由客户机将真基站和/或真认证站点的全部或部分信息记录在本地形成。
步骤1的执行时间可以有多种方式。步骤1可以在客户机与基站建立真正的连接之前即执行。步骤1还可以在客户机与基站已建立真正的连接之中执行，实际中，可以在客户机与基站已建立真正的连接之中，多次反复执行步骤1、步骤2，以识别客户机当前的连接对象是真基站还是信号发射功率强于真基站的伪基站。其中，所述真正的连接是指数据连接，本发明的目的即在于防止伪基站取得客户机的数据(尤其是隐私数据)。
需要说明的是：所述待识别连接对象包括待建立数据连接对象、待继续保持数据连接对象。具体地，所述待识别连接对象可以是客户机的尚未建立数据连接而依赖真伪识别结果考虑是否要建立数据连接的连接对象，即所述待识别连接对象包括待建立数据连接对象，相应地，所述待识别连接对象信息包括待建立数据连接对象信息；所述待识别连接对象还可以是客户机的已建立数据连接且需要依赖真伪识别结果以考虑是否能够继续保持数据连接的连接对象，即所述待识别连接对象包括待继续保持数据连接对象，相应地，所述待识别连接对象信息包括待继续保持数据连接对象信息，进一步地，当客户机与真基站建立数据连接后，若伪基站的发射功率大于真基站，则伪基站会对真基站造成干扰与屏蔽，使得客户机被强制连接到伪基站，因此，即使客户机在当前时刻是与真基站建立的数据连接，但是，在数据连接中不能排除下一个时刻会被强制连接至伪基 站，因此对于客户机而言下一个时刻是否继续数据连接需要进行真伪识别，也就是说，下一时刻的基站对于客户机来讲是一个待识别真伪后才确认是否保持数据连接或者重新数据连接的待识别连接对象。
在步骤2中，若待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果为相匹配一致，则将待识别连接对象识别为真；若待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果为不匹配一致，则将待识别连接对象识别为伪。所述历史连接对象信息包括历史基站信息和/或历史认证信息。
所述客户机本地是相对于基站以及互联网而言的本地，例如，客户机本地可以是客户机内部的存储装置，还可以是与客户机属于同一终端下的存储装置。
所述历史基站信息可以是客户机往次数据连接基站形成的历史信息。形成的方法可以是：相对于客户机在本次准备对待建立数据连接的基站进行真伪识别以建立数据连接前，客户机在往次主动与基站建立数据连接后将该基站信息存储形成为所述历史信息。优选地，所述往次是指历史上的首次或者前次。
所述历史基站信息可以是客户机本次数据连接基站形成的历史信息。形成的方法可以是：客户机在本次主动与基站建立数据连接后，立刻(例如在下一个时隙内)将该基站信息存储为所述历史信息，然后在数据连接的过程中，当再次获取基站信息后，则该基站信息相对于再次获得的基站信息构成历史信息。
所述历史基站信息可以是客户机上存有的历史基站信息表，其中，所述历史基站信息表中记载的基站信息优选地是预先设置的。例如，若希望将客户机的连接基站指定为有限的若干基站，则可以将该若干基站的基站信息预先设置写入历史基站信息表中。
所述历史认证信息包括基站对应的认证站点给与客户机的反馈信息。例如，所述认证站点给与客户机的反馈信息，可以是客户机往次登录与基站对应的认证站点形成的历史信息，还可以是该站点对于特定报文的认证反馈。
所述历史认证信息可以是客户机往次登录与基站对应的认证站点形成的历史信息。在城市的公共场所(例如交通站点、餐厅)，为了使得用户能够快捷方便地上网，构建有wifi热点，当用户需要将智能手机接入wifi热点时，首先需要通过智能手机登录与该wifi热点对应的认证站点(例如i-Shanghai的认证站点)获取上网密码(wifi的安全密钥)，然后有了上网密码客户机才可以接入wifi热点进而连接互联网。其中，形成的方法可以是：相对于客户机在本次准备对待登录的与基站对应的认证站点进行真伪识别以发送登录信息之前，客户机在往次主动与基站建立数据连接后将与该基站对应的认 证站点信息存储形成为所述历史信息。优选地，所述往次是指历史上的首次或者前次。
识别到伪基站时，可以通过提示安全性信息来告知用户，由用户指定重新连接。用户可通过(增加/替换)授信、清除或者更新历史基站信息的方法接纳新的不一致基站，将识别到的伪基站认定为真基站。
在一个优选例中，客户机的待识别连接对象为尚未数据连接的基站，因此需在数据连接前对该基站进行真伪识别，若为真基站，则客户机与该基站建立数据连接，若为伪基站，则客户机生成伪基站的提示。具体地，可以利用基站的无线标识信息作为真伪基站的识别依据，对客户机实现主动连接自保护。
所述步骤1包括在客户机与基站数据连接前执行的如下步骤：
步骤1.1：获取基站的第一无线标识信息和第二无线标识信息；
所述步骤2包括在客户机与基站数据连接前执行的如下步骤：
步骤2.1：将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签；
所述第一无线标识信息，可以为基站的明文标识信息，所述明文标识信息是指能够被伪基站获得且能够被复制伪装的公开信息，例如基站的SSID(Service Set Identifier)、ESSID(Extended Service Set Identifier)、基站所在局域网的网络名称、BSSID(Basic Service Set Identifier)、信道(channel)、设备地址。其中，在手机WLAN中ESSID可认为是wifi网络名。相应地，所述第二无线标识信息，可以为所述明文标识信息之外的无线标识信息，记为非明文标识信息，例如设备厂家信息。其中，在手机WLAN中，BSSID即无线路由的MAC地址。其中，所述的随机是相对于基站而言的，即所述随机是指对于基站是不规律的，而不是固定的。若所述第二无线标识信息不是随机的，例如第二无线标识信息是固定的几种非明文标识信息，则伪基站可以预先对这些非明文标识信息进行设置以达到伪装的目的；而当所述第二无线标识信息是随机的时，伪基站将难以预先知道需要对哪些非明文标识信息进行伪装，例如第二无线标识信息可以有时是一种非明文标识信息，有时是几种非明文标识信息，其中非明文标识信息的种数和种类在每次获取基站信息中均是可以变化的，达到使伪基站找不到规律实现随机的目的。
所述第一无线标识信息，还可以为连接基站的默认认证信息，默认认证信息是指基站被客户机搜索到或者客户机查找到基站前客户机必须得到的基站信息，例如基站的 SSID(Service Set Identifier)、ESSID(Extended Service Set Identifier)或者所在局域网的网络名称。其中，在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。其中，所述的随机是相对于基站而言的，即所述随机是指对于基站是不规律的，而不是固定的。若所述第二无线标识信息不是随机的，例如第二无线标识信息是固定的几种非默认认证信息，则伪基站可以预先对这些非默认认证信息进行设置以达到伪装的目的；而当所述第二无线标识信息是随机的时，伪基站将难以预先知道需要对哪些非默认认证信息进行伪装，例如第二无线标识信息可以有时是一种非默认认证信息，有时是几种非默认认证信息，其中非默认认证信息的种数和种类在每次获取基站信息中均是可以变化的，达到使伪基站找不到规律实现随机的目的。
例如，传统的客户机仅将ESSID作为识别基站的依据，如图3所示，伪基站完全可以将自身的ESSID伪装成“abc”、“xyz”或者“123”。而在本发明中，在建立数据连接前，客户机将表示标签定义为ESSID、BSSID、信道的组合，而非单用ESSID作为识别基站。一旦发现不完全匹配该组合的无线标识信息要求，则客户机告知用户需要通过手动指定ESSID而非自动连接，因为目标连接基站可能不是之前历史上已安全数据连接过的，可能为伪基站。如图4所示，将表示标签定义为ESSID、BSSID、信道的组合，只要一基站的ESSID、BSSID、信道中的任意一项导致其组合与历史基站信息不匹配，就可以识别为伪基站，其中，导致组合不匹配的项已在图4中用下划线标出。
在另一个优选例中，客户机的待识别连接对象为作为待继续保持数据连接对象的基站，由于在客户机与真基站的数据连接过程中客户机有可能会被强制连接至伪基站，因此需要在数据连接中定期或不定期地对当前数据连接的基站进行真伪识别，若当前数据连接的基站为真基站，则客户机继续保持与该真基站的数据连接，若当前数据连接的基站为伪基站，则客户机直接断开数据连接或者生成伪基站的提示。具体地，可以利用基站的固件标签作为真伪基站的识别依据，对客户机实现主动连接自保护。
所述步骤1包括如下步骤：
步骤1-1：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；；
所述步骤2包括在客户机与基站数据连接中执行的如下步骤：
步骤2-1：判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信 息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
当通过上述步骤1.1-1.2或者其它方式可以确认基站为真基站(以及相应确认基站对应的认证站点为真认证站点)后，则客户机主动发起对真基站的连接并认为该连接为可靠连接，也就是说，只有在确认基站为真基站时客户机才会主动发起连接，否则当基站的真伪未识别时客户机不会主动发起连接。
通过步骤1-1、步骤2-1需要多次获取基站信息(和/或认证站点的认证信息)，可靠连接发起时获取的基站信息是在客户机主动发起连接之前最近一次获取的基站信息(以及对应的认证站点的认证信息)，其中，客户机正是通过所述最近一次获取的基站信息识别出基站为真基站(或者通过认证信息识别出认证站点为真认证站点)，从而建立可靠连接，因此所述客户机主动发起连接之前最近一次获取的基站信息对应于可靠连接。当然，次优选地，也可以将建立可靠连接后第一次获取的基站信息作为所述可靠连接发起时获取的基站信息。
所述后续获取的基站信息与所述历史基站信息是否匹配，具体是指后续获取的基站信息与对应可靠连接发起时获取的基站信息进行匹配，若匹配一致，则客户机继续保持当前的数据连接，若匹配不一致，则客户机断开当前的数据连接或者生成伪基站提示。
所述后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配，具体是指后续获取的认证信息与对应可靠连接发起时获取的认证信息进行匹配，若匹配一致，则客户机继续保持当前的数据连接，若匹配不一致，则客户机断开当前的数据连接或者生成伪基站提示。
所述基站信息包括固件标签，相应地，所述步骤1-1具体为以客户机主动发起的连接作为可靠连接，并将对应可靠连接的首次获取的固件标签作为历史基站信息进行存储，所述步骤2-1具体为判断随着数据连接时间的推移，后续次获取的固件标签与所述首次获取的固件标签是否匹配。
获取固件标签的方法包括如下步骤：
步骤i1：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
步骤i2：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站信息。
在建立数据连接后，客户机通过主动发送应用层和数据链路层的报文(例如：HTTP、LLDP、ICMP、DHCP或者SNMP等TCP/UDP协议)与基站私密对话，并接收基站对于客户 机所发送报文的响应和/或反馈报文。
其中，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备发送的报文，所述报文要求当前与客户机数据连接的基站返回记载有该基站的固件设备信息的响应和/或反馈报文，然后客户机从所述响应和/或反馈报文中提取出关于固件设备信息的关键字，组成固件标签。所述固件设备信息可以是固件出厂日期、固件品牌厂家、固件版本号、固件管理标识。所述响应可以为有无响应、TCP连接请求响应等。例如，固件标签可以由标签“tag1(回应报文第一关键字)”、“tag2(回应报文第二关键字)”、“tag3(响应/无响应)”、“tag4(IP网络地址号)”、“tag5(设备管理标识)”以及“tag6(9000个端口的轮训TCP连接请求响应情况)构成。
所述客户机所发送报文，可以是指客户机针对可靠连接中基站对应的认证站点发送的报文。具体地，所述报文可以是SNMP报文。
如果后续次获取的固件标签与所述首次获取的固件标签不一致，则向用户预警与客户机连接的基站已发生变化，提示中断与当前基站的连接，确保安全性。
进一步地，所述报文所要求当前与客户机数据连接的基站返回的固件标签为多种固件设备信息的随机组合。所述的多种固件设备信息的随机组合是相对于基站而言的，即所述随机是指对于基站是不规律的，而不是固定的。而对于客户机而言，所述随机并不是纯粹的随机，随机组合中的固件设备信息可以基于时间、连接对象的信号强度以及客户机支持的IP协议侦测等因素进行设定。这样的好处是，在数据连接中的后续多次获取的固件标签对应的随机组合各不相同，这样就可以实现通过多次识别，避免一次识别就向伪基站暴露客户机所有的识别方法。
更进一步地，所述报文是针对可靠连接中基站的固件设备的，因此，伪基站的固件设备由于不同于真基站的固件设备，因此真基站的固件设备信息对于伪基站来讲是未知的，从而针对可靠连接中基站的固件设备的报文所要求返回的固件设备信息对伪基站来讲是随机的。
在又一个优选例中，客户机的待识别连接对象为与尚未数据连接的基站对应的待登录认证站点。所述步骤1包括在客户机登录与基站对应的认证站点前执行的如下步骤：
步骤101：获取与基站对应的认证站点的站点标签；
步骤102：将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
所述站点标签可以是站点的DNS、站点服务器标签，IP地址等用于识别站点身份的 标签。
对于面向公众的开放式的无线局域网(例如快餐店中的无线局域网)，在允许客户机接入无线局域网基站之前，需要客户机通过统一的后台认证站点登录后做用户名认证，然后才能获得上网密码。对于这样的开放式的无线局域网，客户机在连接到伪基站后，与伪基站对应的认证站点可以是钓鱼站点，这样不仅仅可以继续诱骗，还能得到用户的个性化的用户认证信息。此时，这种标签进一步拓宽到后台的认证站点检测(DNS、站点服务器标签，IP地址等等)。因此，客户机可以在往次主动与基站建立数据连接后将与该基站对应的认证站点的站点标签存储形成为所述历史认证信息，从而在当前客户机准备对待登录的与基站对应的认证站点进行真伪识别以发送登录信息之前，将当前认证站点的站点标签与所述历史认证信息进行匹配，若匹配一致，则将当前认证站点识别为真，否则识别为伪。
下面对一个优选的具体实施方式进行描述。
在作为客户机的智能移动设备系统(android/ios/wp/linux等系统)中嵌入本发明提供的基于无线安全的客户机自连接保护系统，或者在集成电路芯片中(如51单片机/arm单片机/avr单片机/嵌入式模块中)，嵌入本发明提供的基于无线安全的客户机自连接保护系统，采用如下步骤：
-客户机判断附近是否存在可连接且历史上数据连接过的热点基站；若存在，则进入下述步骤继续执行；若不存在，则对可用热点基站进行手动触发连接；
-通过执行上述步骤1.1、步骤2.1利用表示标签对基站进行真伪识别；若识别结果为真，则与该真基站进行数据连接，若识别结果为伪，则由用户判断是否需要手动触发连接；
-在数据连接中，通过执行上述步骤1-1、步骤2-1利用固件标签对当前连接的基站进行真伪识别；若识别结果为真，则与该真基站保持数据连接，若识别结果为伪，则由用户判断是否需要继续；
-通讯结束后，客户机记载热点基站的表示标签和固件标签作为历史基站信息。
本发明还提供一种存储有计算机程序的计算机可读存储介质，其中，所述计算机可读存储介质中的计算机程序使计算机执行所述基于无线安全的客户机自连接保护方法，所述计算机可读存储介质包括光盘、磁盘、ROM、PROM、VCD、DVD等；所述基于无线安全的客户机自连接保护方法包括如下步骤：
步骤1：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息 和/或与基站对应的认证信息；
步骤2：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息。
优选地，历史基站信息包括如下任意一种或任意多种信息：
-客户机往次数据连接基站形成的历史信息；
-客户机本次数据连接基站形成的历史信息；
-客户机上存有的历史基站信息表。
优选地，历史认证信息包括：
-基站对应的认证站点给与客户机的反馈信息
优选地，所述步骤1包括在客户机与基站数据连接前执行的如下步骤：
步骤1.1：获取基站的第一无线标识信息和第二无线标识信息；
所述步骤2包括在客户机与基站数据连接前执行的如下步骤：
步骤2.1：将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签；
优选地，所述步骤1.1，包括如下步骤：
-在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
优选地，所述步骤1包括如下步骤：
步骤1-1：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；
步骤2包括在客户机与基站数据连接中执行的如下步骤：
步骤2-1：判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
优选地，所述基站信息包括固件标签，获取基站信息的方法包括如下步骤：
步骤i1：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
步骤i2：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站信息。
优选地，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
优选地，所述步骤1包括在客户机登录与基站对应的认证站点前执行的如下步骤：
步骤101：获取与基站对应的认证站点的站点标签；
步骤102：将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
本领域技术人员知道，除了以纯计算机可读程序代码方式实现本发明提供的系统及其各个装置以外，完全可以通过将方法步骤进行逻辑编程来使得本发明提供的系统及其各个装置以逻辑门、开关、专用集成电路、可编程逻辑控制器以及嵌入式微控制器等的形式来实现相同功能。所以，本发明提供的系统及其各项装置可以被认为是一种硬件部件，而对其内包括的用于实现各种功能的装置也可以视为硬件部件内的结构；也可以将用于实现各种功能的装置视为既可以是实现方法的软件模块又可以是硬件部件内的结构。
以上对本发明的具体实施例进行了描述。需要理解的是，本发明并不局限于上述特定实施方式，本领域技术人员可以在权利要求的范围内做出各种变化或修改，这并不影响本发明的实质内容。在不冲突的情况下，本发明的实施例和实施例中的特征可以任意相互组合。

Claims (18)

  1. 一种基于无线安全的客户机自连接保护方法，其特征在于，包括如下步骤：
    步骤1：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；
    步骤2：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
    其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息。
  2. 根据权利要求1所述的基于无线安全的客户机自连接保护方法，其特征在于，历史基站信息包括如下任意一种或任意多种信息：
    -客户机往次数据连接基站形成的历史信息；
    -客户机本次数据连接基站形成的历史信息；
    -客户机上存有的历史基站信息表。
  3. 根据权利要求1所述的基于无线安全的客户机自连接保护方法，其特征在于，历史认证信息包括：
    -基站对应的认证站点给与客户机的反馈信息。
  4. 根据权利要求1所述的基于无线安全的客户机自连接保护方法，其特征在于，所述步骤1包括在客户机与基站数据连接前执行的如下步骤：
    步骤1.1：获取基站的第一无线标识信息和第二无线标识信息；
    所述步骤2包括在客户机与基站数据连接前执行的如下步骤：
    步骤2.1：将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
    其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签。
  5. 根据权利要求4所述的基于无线安全的客户机自连接保护方法，其特征在于，所述步骤1.1，包括如下步骤：
    -在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
  6. 根据权利要求1所述的基于无线安全的客户机自连接保护方法，其特征在于，所述步骤1包括如下步骤：
    步骤1-1：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到 的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；
    所述步骤2包括在客户机与基站数据连接中执行的如下步骤：
    步骤2-1：判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获得的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
  7. 根据权利要求6所述的基于无线安全的客户机自连接保护方法，其特征在于，所述基站信息包括固件标签，获取基站信息的方法包括如下步骤：
    步骤i1：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
    步骤i2：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基站信息。
  8. 根据权利要求7所述的基于无线安全的客户机自连接保护方法，其特征在于，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
  9. 根据权利要求1所述的基于无线安全的客户机自连接保护方法，其特征在于，所述步骤1包括在客户机登录与基站对应的认证站点前执行的如下步骤：
    步骤101：获取与基站对应的认证站点的站点标签；
    步骤102：将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
  10. 一种基于无线安全的客户机自连接保护系统，其特征在于，包括如下装置：
    第一获取装置：获取待识别连接对象信息，其中，所述待识别连接对象信息包括基站信息和/或与基站对应的认证信息；
    第一识别装置：根据所述待识别连接对象信息与客户机本地的历史连接对象信息的匹配结果，对待识别连接对象进行真伪识别；
    其中，所述历史连接对象信息包括历史基站信息和/或历史认证信息。
  11. 根据权利要求10所述的基于无线安全的客户机自连接保护系统，其特征在于，历史基站信息包括如下任意一种或任意多种信息：
    -客户机往次数据连接基站形成的历史信息；
    -客户机本次数据连接基站形成的历史信息；
    -客户机上存有的历史基站信息表。
  12. 根据权利要求10所述的基于无线安全的客户机自连接保护系统，其特征在于，历史认证信息包括：
    -基站对应的认证站点给与客户机的反馈信息。
  13. 根据权利要求10所述的基于无线安全的客户机自连接保护系统，其特征在于，所述第一获取装置包括如下装置：
    第二获取装置：在客户机与基站数据连接前，获取基站的第一无线标识信息和第二无线标识信息；
    所述第一识别装置包括如下装置：
    第二识别装置：在客户机与基站数据连接前，将第一无线标识信息与第二无线标识信息的组合，与历史基站信息进行匹配，根据匹配结果对所述基站进行真伪识别；
    其中，所述第一无线标识信息与第二无线标识信息的组合，记为表示标签。
  14. 根据权利要求13所述的基于无线安全的客户机自连接保护系统，其特征在于，所述第二获取装置，包括如下装置：
    -第一策略装置：在获取基站的第二无线标识信息时，随机将基站的一种非默认认证信息或多种非默认认证信息的组合作为所述基站的第二无线标识信息。
  15. 根据权利要求10所述的基于无线安全的客户机自连接保护系统，其特征在于，所述第一获取装置包括如下装置：
    第三获取装置：以客户机主动发起的连接作为可靠连接，将这种可靠连接发起时获取到的基站信息进行本地存储为历史基站信息，和/或该基站对应认证站点的认证信息作为历史认证信息；；
    所述第一识别装置包括的如下装置：
    第三识别装置：在客户机与基站数据连接中，判断随着数据连接时间的推移，后续获取的基站信息与所述历史基站信息是否匹配，和/或后续获取的基站对应的认证站点的认证信息与所述历史认证信息是否匹配。
  16. 根据权利要求15所述的基于无线安全的客户机自连接保护系统，其特征在于，包括第一接收装置、第一提取装置；所述基站信息包括固件标签，获取基站信息的方法通过如下装置执行：
    第一接收装置：接收基站和/或基站对应的认证站点对于客户机所发送报文的响应和/或反馈报文；
    第一提取装置：从所述响应和/或反馈报文中提取出关键字，组成固件标签作为基 站信息。
  17. 根据权利要求16所述的基于无线安全的客户机自连接保护系统，其特征在于，所述客户机所发送报文，是指客户机针对可靠连接中基站的固件设备和/或基站对应的认证站点发送的报文。
  18. 根据权利要求10所述的基于无线安全的客户机自连接保护系统，其特征在于，所述第一获取装置包括如下装置：
    第四获取装置：在客户机登录与基站对应的认证站点前，获取与基站对应的认证站点的站点标签；
    第四识别装置：在客户机登录与基站对应的认证站点前，将站点标签与历史认证信息进行匹配，根据匹配结果对所述基站进行真伪识别。
PCT/CN2016/101526 2015-08-26 2016-10-09 基于无线安全的客户机自连接保护方法和系统 WO2017032346A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201510531851.3A CN105101210A (zh) 2015-08-26 2015-08-26 基于无线安全的客户机自连接保护方法和系统
CN201510531851.3 2015-08-26

Publications (1)

Publication Number Publication Date
WO2017032346A1 true WO2017032346A1 (zh) 2017-03-02

Family

ID=54580536

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2016/101526 WO2017032346A1 (zh) 2015-08-26 2016-10-09 基于无线安全的客户机自连接保护方法和系统

Country Status (2)

Country Link
CN (1) CN105101210A (zh)
WO (1) WO2017032346A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105101210A (zh) * 2015-08-26 2015-11-25 盾宇（上海）信息科技有限公司 基于无线安全的客户机自连接保护方法和系统
CN106792694B (zh) * 2016-12-30 2020-02-18 Oppo广东移动通信有限公司 一种接入认证方法，及接入设备
CN108616817B (zh) * 2018-05-15 2020-12-15 中国联合网络通信集团有限公司 用户认证方法、应用服务器、终端以及轨迹服务器
CN109195204B (zh) * 2018-11-12 2021-02-12 Oppo广东移动通信有限公司 无线网络接入方法及装置、计算机可读介质、通信终端

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005039147A1 (en) * 2003-09-15 2005-04-28 Intel Corporation Method, apparatus and system for detection of and reaction to rogue access points
CN102244867A (zh) * 2010-05-14 2011-11-16 新浪网技术(中国)有限公司 一种网络接入控制方法和系统
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104219668A (zh) * 2014-09-10 2014-12-17 北京金山安全软件有限公司 确定无线网络接入点安全性的方法、装置、服务器及移动终端
CN105101210A (zh) * 2015-08-26 2015-11-25 盾宇（上海）信息科技有限公司 基于无线安全的客户机自连接保护方法和系统

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101820628B (zh) * 2010-03-10 2014-01-29 北京傲天动联技术股份有限公司 无线接入点的认证方法
CN103428189B (zh) * 2012-05-25 2016-06-29 阿里巴巴集团控股有限公司 一种识别恶意网络设备的方法、装置和系统
CN103491543A (zh) * 2013-09-30 2014-01-01 北京奇虎科技有限公司 通过无线终端检测恶意网址的方法、无线终端
CN103841220A (zh) * 2014-02-18 2014-06-04 北京奇虎科技有限公司 通过终端检测路由器安全的方法及装置
CN104113842B (zh) * 2014-07-31 2017-10-24 北京金山安全软件有限公司 识别伪无线网络接入点的方法、装置、服务器及移动终端
CN104219670B (zh) * 2014-09-03 2018-06-08 珠海市君天电子科技有限公司 识别虚假wifi的方法、客户端和系统
CN104243490B (zh) * 2014-09-30 2017-12-22 北京金山安全软件有限公司 识别伪无线网络接入点的方法、装置及移动终端
CN104349325B (zh) * 2014-11-07 2018-09-28 工业和信息化部通信计量中心 用于监测伪无线接入点ap的方法及装置
CN104580152A (zh) * 2014-12-03 2015-04-29 中国科学院信息工程研究所 一种防护wifi钓鱼的保护方法及系统
CN104853448A (zh) * 2015-05-08 2015-08-19 乐视致新电子科技（天津）有限公司 自动建立无线连接的方法和装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2005039147A1 (en) * 2003-09-15 2005-04-28 Intel Corporation Method, apparatus and system for detection of and reaction to rogue access points
CN102244867A (zh) * 2010-05-14 2011-11-16 新浪网技术(中国)有限公司 一种网络接入控制方法和系统
CN104023336A (zh) * 2014-06-13 2014-09-03 张力军 移动终端的无线接入方法及移动终端
CN104219668A (zh) * 2014-09-10 2014-12-17 北京金山安全软件有限公司 确定无线网络接入点安全性的方法、装置、服务器及移动终端
CN105101210A (zh) * 2015-08-26 2015-11-25 盾宇（上海）信息科技有限公司 基于无线安全的客户机自连接保护方法和系统

Also Published As

Publication number Publication date
CN105101210A (zh) 2015-11-25

Similar Documents

Publication Publication Date Title
KR101999148B1 (ko) 로그 ap 탐지 시스템 및 방법과, 이를 위한 사용자 단말 및 컴퓨터 프로그램
US9553897B2 (en) Method and computer device for monitoring wireless network
RU2546610C1 (ru) Способ определения небезопасной беспроводной точки доступа
US8769639B2 (en) History-based downgraded network identification
US20150040194A1 (en) Monitoring of smart mobile devices in the wireless access networks
US20160119316A1 (en) Wireless network authentication method and wireless network authentication apparatus
WO2017032346A1 (zh) 基于无线安全的客户机自连接保护方法和系统
US7710933B1 (en) Method and system for classification of wireless devices in local area computer networks
CN112261708B (zh) 一种自动化批量配置WiFi设备的系统和方法
CN105682093A (zh) 无线网络接入方法及接入装置和客户端
US9730061B2 (en) Network authentication
CN101379795A (zh) 在由认证服务器检查客户机证书的同时由dhcp服务器进行地址分配
WO2014114099A1 (zh) 无线局域网防范非法接入点的方法及系统
CN106572464B (zh) 无线局域网中非法ap监测方法及其抑制方法、监测ap
WO2017032347A1 (zh) 基于客户机的主动防基站诱骗方法和系统
CN103313429A (zh) 一种识别伪造wifi热点的处理方法
WO2017128546A1 (zh) 一种WiFi网络安全接入方法及装置
KR101606352B1 (ko) 로그 ap 탐지를 위한 시스템, 사용자 단말, 방법 및 이를 위한 컴퓨터 프로그램
JP2017168909A (ja) 無線通信プログラム、方法及び装置
CN107969004B (zh) 联网系统、联网方法
CN107302785B (zh) 一种接入方法、智能设备、网关及接入系统
KR20150041407A (ko) 신뢰 액세스포인트 접속 장치 및 방법
CN111405548B (zh) 一种钓鱼wifi的检测方法及装置
Huang et al. A whole-process WiFi security perception software system
KR101083727B1 (ko) 무선 네트워크 보안 장치 및 그 방법

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 16838604

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 16838604

Country of ref document: EP

Kind code of ref document: A1